Magenta

Magenta is a block cipher with a complex and deeply nested design.
However, the S-box has a simple structure, and there are also
weaknesses in the key schedule. This led to cryptanalytic results
being obtained against it shortly after it was disclosed. Although it
has been claimed that there are other weaknesses in the design, it
still seems to me that the design contains some useful principles.

Our last preparatory definition is that of C(n,w), where n is a number, and w a 16-bit vector, as
the following:

C(1,w) = T(w)

C(n+1,w) = T(w xor S(C(n,w)))

Note that n is not a piece of the key or of the block being encrypted; it is a parameter
giving the depth of recursion used.

Finally, with all these definitions, Magenta is a Feistel cipher.

Each Feistel round is expressed as taking (X(1),X(2)), where each X is
half the block, 64 bits in length, and replacing it with (X(2),X(1) xor F(X(2),SK(n))),
where n is the round number, and SK(n) the n-th subkey.

The F function equals the first eight bytes of S(C(3,(X(2),SK(n)))).

Thus, a round of Magenta may be pictured as follows:

Since the Magenta f-function consists of a non-invertible function
applied to one half of the block with the key appended, the Magenta
block cipher is a multi-round example of a Luby-Rackoff construction.

The key schedule is as follows:

for a 128-bit key, the key is divided into parts, K1, K2, and the
subkeys for the six rounds in order are K1, K1, K2, K2, K1, K1.

for a 192-bit key, K1, K2, K3, K3, K2, K1.

for a 256-bit key, K1, K2, K3, K4, K4, K3, K2, K1.

It appears that, except for swapping halves, Magenta is reciprocal.
The first paper giving a cryptanalysis of Magenta incorrectly gave the
key schedule as K1 K2 K1 K1 K2 K1, it appears.

Originally, the F function was going to be the first eight
bytes of S(C(7,(X(2),SK(n)))), but the number of rounds inside
the f-function was reduced because of a possible weakness. Even so,
Magenta is deeply nested with complexity.